joserfc
PyPI6 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting joserfcpage 1 of 1
- CVE-2025-65015HIGHCVSS 7.5EG 7.5fixed in 1.3.5 or 1.4.2, by version range2025-11-18
vulnerable: 1.3.3, 1.3.4, 1.4.0, 1.4.1
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions from 1.3.3 to before 1.3.5 and from 1.4.0 to before 1.4.2, the ExceededSizeError exception messages are…
- CVE-2026-119283HIGHCVSS 7.5EG 7.5fixed in 1.7.52026-10-29
vulnerable: 0.1.0 ... 1.7.4 (46 versions)
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a JWE General JSON Serialization recipients array without a coun…
- CVE-2026-119284MEDIUMCVSS 6.9EG 6.9fixed in 1.7.62026-10-29
vulnerable: 0.1.0 ... 1.7.5 (47 versions)
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.6, joserfc compact JWS deserialization calls bytes.split() before enforcing the existing aggregate seg…
- CVE-2026-27932HIGHCVSS 7.5EG 7.5fixed in 1.6.32026-03-03
vulnerable: 0.1.0 ... 1.6.2 (36 versions)
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In 1.6.2 and earlier, a resource exhaustion vulnerability in joserfc allows an unauthenticated attacker to cause a …
- CVE-2026-48990MEDIUMCVSS 5.3EG 5.3fixed in 1.6.72026-06-17
vulnerable: 1.3.4 ... 1.6.5 (13 versions)
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions 1.3.4 through 1.6.5, joserfc accepts oversized RFC7797 b64=false JWS payloads without applying JWSRegis…
- CVE-2026-49852HIGHCVSS 8.7EG 8.7fixed in 1.6.82026-07-02
vulnerable: 0.1.0 ... 1.6.7 (40 versions)
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.6.8, joserfc.jwt.decode accepts attacker-forged HMAC-signed tokens when the caller-supplied verification…
Check whether joserfc is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for joserfc CVEs against the assets you own.
Book a Demo →